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(10) CLAIMS APPENDIX Pages 



Following are all the claims in this case. The one al- 
lowed claim, claim 84, is included for the Board's convenience 
and for completeness. 

For the Board's information, the date of most-recent 
amendment is included for each claim, other than the original 
claims . 

1 1. (amended May 15, 2006) Apparatus for deterring failure of 

2 a computing system; said apparatus comprising: 

3 a hardware network of components, having substantially no 

4 software and substantially no firmware except programs held in 
s an unalterable read-only memory; 

6 terminals of the network for connection to such system; 

7 and 

a fabrication-preprogrammed hardware circuits of the net- 

9 work for guarding such system from such failure. 



Appeal Brief 



09/886,959 



51 



P. Lippman ■ xAAA-02 



1 2. (amended May 15, 2 006) The apparatus of claim 1, particu- 

2 larly for use with such system that is substantially exclu- 

3 sively made up of commercial, off-the-shelf components; and 

4 wherein: 

5 at least one of the network terminals is connected to 

6 receive at least one error signal generated by such system in 

7 event of incipient such failure of such system; 

8 at least one of the network terminals is connected to 

s provide at least one recovery signal to such system upon re- 

10 ceipt of the error signal; and 

n the apparatus further comprises means for automatically 

12 responding to the at least one error signal by generating the 

13 at least one recovery signal for guarding all of such system 

14 against such failure. 

1 3. (amended October 12, 2005) The apparatus of claim 1, 

2 wherein: 

3 the network is an infrastructure which is generic in that 

4 it can accommodate any such system that can issue an error 
s message and handle a recovery command. 

1 4. (original) The apparatus of claim 1, further comprising: 

2 such computing system. 

1 5. (original) The apparatus of claim 1, wherein: 

2 the circuits comprise portions for identifying failure of 

3 any of the circuits and correcting for the identified failure. 
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1 6. (amended October 12, 2005) The apparatus of claim 1, 

2 wherein: 

3 the circuits are not capable of running any application 

4 program, 

1 7. (amended May 15, 2 006) The apparatus of claim 1, particu- 

2 larly for use with a computing system that is substantially 

3 exclusively made of commercial, off-the-shelf components and 

4 that has at least one hardware subsystem for generating a 

5 response of the system to failure; and wherein: 

6 the circuits comprise portions for reacting to such re- 

7 sponse of such hardware subsystem. 

1 8, (original) The apparatus of claim 1, particularly for use 

2 with a computing system that has plural generally parallel 

3 computing channels; and wherein: 

4 the circuits comprise portions for comparing computatio- 

5 nal results from such parallel channels. 

1 9. (amended May 15, 2 006) The apparatus of claim 8, wherein: 

2 the parallel channels of such computing system are of 

3 diverse design or manufacture. 

1 10. (amended May 15, 2006) The apparatus of claim 1, particu- 

2 larly for use with a computing system that has plural proces- 

3 sors; and wherein: 

4 the circuits comprise portions for identifying such fai- 
s lure of any of such processors and correcting for identified 

6 such failure. 
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1 11. (amended October 12, 20 05) The apparatus of claim 1, 

2 wherein: 

3 the circuits comprise modules for collecting and respond- 

4 ing to data received from at least one of the terminals, said 

5 modules comprising: 

6 

7 at least three data-collecting and -responding mod- 

8 ules, and 

9 

10 processing sections for conferring among the modules 

n to determine whether any of the modules has 

12 failed. 



1 12. (amended May 15, 2006) The apparatus of claim 1, particu- 

2 larly for use with a computing system that is substantially 

3 exclusively made of commercial, off-the-shelf components and 

4 that has at least one subsystem for generating a response of 

5 the system to failure, and that also has at least one subsystem 
€ for receiving recovery commands; and wherein: 

7 the circuits comprise portions for interposing analysis 

a and a corrective reaction between such response- generating sub- 

9 system and such command- receiving subsystem. 
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1 13. (amended May 15, 2006) Apparatus for deterring failure of 

2 an entire computing system, wherein the computing system optio- 

3 nally includes plural mutually redundant modules; said appara- 

4 tus comprising: 

s a network of components having terminals for connection 

6 to such system, wherein the network is constructed to be ini- 

7 tially and permanently distinct from such computing system 
a including all of such redundant modules if present; and 

9 circuits of the network for operating programs to guard 

10 such entire system from such failure; 

n the circuits comprising portions for identifying such 

12 failure of any of the circuits and correcting for the identi- 

13 fied such failure. 

1 14. (amended May 15, 2006) The apparatus of claim 13, where- 

2 in: 

3 the program- operating portions comprise a section that 

4 corrects for the identified such failure by automatically tak- 

5 ing a failed circuit out of operation. 

15. (amended October 12, 2005) The apparatus of claim 13, 



wherein: 

the network is an infrastructure that continuously waits 
to respond to messages from such system. 

1 16. (original) The apparatus of claim 13, further comprising: 

2 such computing system. 
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1 17. (amended May 15, 2006) The apparatus of claim 13, where- 

2 in: 

3 the program- operating portions comprise at least three of 

4 the circuits; and 

s such failure is identified at least in part by majority 

e vote among the at least three circuits. 

1 18. (amended May 15, 2006) The apparatus of claim 13, where- 

2 in: 

3 to guard such entire system from failure, said circuits 

4 receive from such system error messages warning of incipient 
s such failure, and issue recovery commands to such system, 

1 19. (amended May 15, 2006) The apparatus of claim 13, partic- 

2 ularly for use with a computing system that is substantially 

3 exclusively made of commercial, off-the-shelf components and 

4 that has at least one hardware subsystem for generating a 

5 response of the system to failure; and wherein: 

e the circuits comprise portions for reacting to such re- 

7 sponse of such hardware subsystem. 



1 20. (original) The apparatus of claim 13, particularly for 

2 use with a computing system that has plural generally parallel 

3 computing channels; and wherein: 

4 the circuits comprise portions for comparing computatio- 
s nal results from such parallel channels. 
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1 21. (amended May 15, 2006) The apparatus of claim 16, where- 

2 in: 

3 the computing system has such parallel channels that are 

4 of diverse design. 

[For the board's convenience: please see claim 70, added May 15, 2006 
and preferably for insertion here . ] 

1 22. (amended May 15, 2006) The apparatus of claim 13, par- 

2 ticularly for use with a computing system that has plural pro- 

3 cessors; and wherein: 

4 the circuits comprise portions for identifying such fai- 
s lure of any of such processors, based on error messages from 

6 such system, and for correcting for identified such failure. 

1 23. (amended October 12, 2005) The apparatus of claim 13, 

2 wherein: 

3 the network is an infrastructure which is generic in that 

4 it can accommodate any such system that can issue an error 
s message and handle a recovery command. 
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24. (amended October 12, 2005) The apparatus of claim 13, 
particularly for use with a computing system that is substan- 
tially exclusively made of commercial, off-the-shelf compo- 
nents and that has at least one subsystem for generating a 
response of the system to failure, and that also has at least 
one subsystem for receiving recovery commands; and wherein: 

the circuits comprise portions for interposing analysis 
and a corrective reaction between such response -generating 
subsystem and such command- receiving subsystem. 

25. - 32. (canceled) 

33. (amended October 12, 2005) Apparatus for deterring 
failure of a computing system that is substantially exclu- 
sively made of commercial, off-the-shelf components and that 
has at least one hardware subsystem for generating an error 
message of the system about incipient failure; said apparatus 
comprising: 

a network of components having terminals for connection 
to such system; and 

circuits of the network for operating programs to guard 
such system from failure; 

the circuits comprising portions for reacting to such 
error message of such hardware subsystem. 

34. (amended October 27, 2005) The apparatus of claim 33, 
wherein: 

in response to such error message, the circuits guard the 
entire such system from failure. 
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35. (amended October 12, 2005) The apparatus of claim 33, 
wherein: 

the network is generic in that it can accommodate any 
such system that can issue an error message and handle a re- 
covery command. 

36. (original) The apparatus of claim 33, further 
comprising: 

such computing system, including such hardware subsystem. 

37. (amended May 15, 2006) The apparatus of claim 36, where- 
in: 

the computing system has plural generally parallel com- 
puting channels; and 

such parallel channels of the computing system are of di- 
verse design or manufacture. 

38. (amended May 15, 2006) The apparatus of claim 33, where- 
in: 

said circuits are not capable of operating any applica- 
tion program; and are not controlled by any associated host 
computer that is capable of running any application program. 



39. and 40. (canceled) 
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41. (amended October 12, 2005) The apparatus of claim 33, 
particularly for use with a computing system that is substan- 
tially exclusively made of commercial, off-the-shelf compo- 
nents and that has at least one subsystem for generating a 
response of the system to failure, and that also has at least 
one subsystem for receiving recovery commands; and wherein: 

the circuits comprise portions for interposing analysis 
and a corrective reaction between such response-generating 
subsystem and such command- receiving subsystem. 

42. (amended May 15, 2006) Apparatus for deterring failure 
of an entire computing system that is distinct from the appa- 
ratus and that has plural generally parallel computing chan- 
nels and has at least one application-data input module, and 
at least one processor for running an application program; 
said apparatus comprising: 

a network of components having terminals for connection 
to such system; and 

circuits of the network for operating programs to guard 
such entire system from such failure, wherein the network is 
constructed to be initially and permanently distinct from such 
computing system including substantially (a) every such appli- 
cation-data input module and (b) every such application- 
program processor, and (c) all of such parallel computing 
channels; 

the circuits comprising portions for comparing computa- 
tional results from such parallel channels. 

43. (original) The apparatus of claim 47, wherein: 

the parallel channels of the computing system are of di- 
verse design . 
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44. (original) The apparatus of claim 42, wherein: 

the comparing portions comprise at least one section for 
analyzing discrepancies between the results from such parallel 
channels . 

45. (amended October 12, 2005) The apparatus of claim 44, 
wherein: 

the circuits are not capable of running any application 
program, 

46. (amended October 12, 2005) The apparatus of claim 42, 
wherein: 

the network is an infrastructure which is generic in that 
it can accommodate any such system that can issue an error 
message and computational results, and handle a recovery 
command . 

47. (original) The apparatus of claim 42, further compris- 
ing: 

such computing system. 

48. (amended May 15, 2006) The apparatus of claim 42, where- 
in: 

the circuits do not and cannot operate any application 
program; and are not controlled by any associated host compu- 
ter that is capable of running any application program. 
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1 49. (amended May 15, 2006) The apparatus of claim 48, where- 

2 in: 

3 to guard such entire system from failure, the circuits 

4 receive from such computing system error messages warning of 
s incipient such failure and issue recovery commands to such 

6 computing system. 



1 50. (amended May 15, 2006) Apparatus for deterring failure 

2 of an entire computing system that is distinct from the appa- 

3 ratus and that has plural generally parallel computing chan- 

4 nels; said apparatus comprising: 

5 a network of components having terminals for connection 

6 to such system; and 

7 circuits of the network for operating programs to guard 

8 such entire system from such failure, wherein such network is 

9 constructed to be initially and permanently distinct from such 

10 computing system including all of such parallel computing 

11 channels; 

12 the circuits comprising portions for comparing computa- 

13 tional results from such parallel channels; and wherein: 

14 the comparing portions comprise circuitry for performing 
is an algorithm to validate a match that is inexact; and 

is the algorithm-performing circuitry employs a degree of 

n inexactness suited to a type of computation under comparison. 
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51, (amended October 27, 2005) The apparatus of claim 50, 
wherein: 

the algorithm-performing circuitry performs an algorithm 
that selects a degree of inexactness based on type of computa- 
tion under comparison; and 

the circuits also impose corrective action upon such sys- 
tem based upon discrepancies found by the comparing portions. 



[CLAIMS 71 THROUGH 74 WERE ADDED MAY 15, 2006, 
PREFERABLY FOR INSERTION HERE . ] 



52. (amended May 15, 2006) The apparatus of claim 42, par- 
ticularly for use with a computing system that has plural 
processors; and wherein: 

the circuits comprise portions for identifying such fai- 
lure of any of such processors and correcting for identified 
such failure. 
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1 53. (original) The apparatus of claim 42, wherein: 

2 the circuits comprise modules for collecting and respond- 

3 ing to data received from at least one of the terminals, said 

4 modules comprising: 

s 

6 at least three data-collecting and -responding mod- 

7 ules, and 

8 

9 processing sections for conferring among the modules 

10 to determine whether any of the modules has 

11 failed. 



1 54. (amended October 12, 2005) The apparatus of claim 42, 

2 particularly for use with a computing system that is subs tan - 

3 tially exclusively made of commercial, off-the-shelf compo- 

4 nents and that has at least one subsystem for generating a 

5 response of the system to failure, and that also has at least 

6 one subsystem for receiving recovery commands; and wherein: 

7 the circuits comprise portions for interposing analysis 

8 and a corrective reaction between such response-generating 

9 subsystem and such command- receiving subsystem. 
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1 55. (amended May 15/ 2006) Apparatus for deterring failure 

2 of any computing system that has plural processors and has at 

3 least one application- data input module, and at least one 

4 processor for running an application program, and is capable 

5 of generating an error message warning of incipient failure 

6 and capable of responding to a recovery command; said appara- 

7 tus comprising: 

8 a network of components having terminals for connection 

9 to such system, wherein the network is constructed to be 

10 initially and permanently distinct from such any computing 

11 system including substantially (a) every such application-data 

12 input module and (b) every such application-program processor, 

13 and (c) all of such plural processors; and 

14 circuits of the network for operating programs to guard 
is any such system from such failure; 

16 the circuits comprising portions for identifying such 

17 failure of any of such processors and correcting for identi- 

18 fied such failure. 

[CLAIM 75 WAS ADDED MAY 15, 2006, 
PREFERABLY FOR INSERTION HERE.] 

1 56. (amended May 15, 2006) The apparatus of claim 75, where- 

2 in: 

3 the identifying portions comprise a section that corrects 

4 for the identified such failure by taking a failed processor 
s out of operation. 
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57. (amended October 12, 2005) The apparatus of claim 75, 
wherein: 

the circuits cannot and do not run an application pro- 
gram. 

58. (amended October 12, 2005) The apparatus of claim 75, 
wherein: 

the circuits protect the entire such computing system. 

59. (amended October 12, 2005) The apparatus of claim 75, 
further comprising : 

such computing system. 

60. (canceled) 

61. (amended October 12, 2 0 05) The apparatus of claim 75, 
particularly for use with a computing system that is substan- 
tially exclusively made of commercial, off-the-shelf compo- 
nents and that has at least one subsystem for generating a 
response of the system to failure, and that also has at least 
one subsystem for receiving recovery commands; and wherein: 

the circuits comprise portions for interposing analysis 
and a corrective reaction between such response -generating 
subsystem and such command- receiving subsystem. 
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1 62. (amended May 15, 2006) Apparatus for deterring failure 

2 of an entire computing system that is distinct from the appa- 

3 ratus and has at least one application-data input module, and 

4 at least one processor for running an application program; 

5 said apparatus comprising: 

e a network of components having terminals for connection 

7 to such system; and 

8 circuits of the network for operating programs to guard 

9 such entire system from such failure; 

10 the circuits comprising modules for collecting and re- 

11 sponding to data received from at least one of the terminals, 

12 said modules comprising: 

13 

14 at least three data-collecting and -responding mod- 

is ules, and 

16 

'17 processing sections for conferring among the modules 

is to determine whether any of the modules has 

19 failed; 

20 

21 wherein the network, including all of the modules and 

22 substantially (a) every such application-data input module and 

23 (b) every such application-program processor, and (c) all of 

24 the processing sections, is constructed to be initially and 

25 permanently distinct from such computing system. 



1 63. (original) The apparatus of claim 62, further 

2 comprising: 

3 such computing system. 
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1 64. (amended October 12, 2005) The apparatus of claim 62, 

2 particularly for use with a computing system that is substan- 

3 tially exclusively made of commercial, off-the-shelf compo- 

4 nents and that has at least one subsystem for generating a 

s response of the system to failure, and that also has at least 

6 one subsystem for receiving recovery commands; and wherein: 

7 the circuits comprise portions for interposing analysis 

8 and a corrective reaction between such response -generating 

9 subsystem and such command- receiving subsystem. 

[Claims 7 6 through 7 8 were added May 15, 2 0 06, 

PREFERABLY FOR INSERTION HERE . ] 

1 65. (amended May 15, 2006) Apparatus for deterring failure 

2 of a computing system that is substantially exclusively made 

3 of commercial, off-the-shelf components and that has at least 

4 one subsystem for generating a response of the system to 

s failure, and that also has at least one subsystem for receiv- 

6 ing recovery commands; said apparatus comprising: 

7 a network of components having terminals for connection 
s to such system between the response- generating subsystem and 
9 the recovery- command- receiving subsystem; and 

10 circuits of the network for operating programs to guard 

11 such system from such failure; 

12 the circuits comprising portions for interposing analysis 

13 and a corrective reaction between the response-generating sub- 

14 system and the command- receiving subsystem. 
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66. (amended August 9, 2004) The apparatus of claim 65, fur- 
ther comprising: 

such computing system. 

67. (added October 12, 2005) The apparatus of claim 65, 
wherein: 

the circuits cannot and do not run any application pro- 
gram. 

68. (amended May 15, 2006) The apparatus of claim 65, where- 
in: 

by responding to an error signal from such system, the 
circuits protect the entire such system from failure. 

69. (added October 12, 2005) The apparatus of claim 65, 
wherein: 

the network is an infrastructure which is generic in that 
it can accommodate any such system that can issue an error 
message and handle a recovery command. 

70. (amended May 15, 2006) The apparatus of claim 13, where- 
in: 

the circuits do not and cannot operate any application 
program; and are not controlled by any associated host compu- 
ter that is capable of running any application program. 
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71. (added October 12, 2 005) The apparatus of claim 50, 
wherein: 

the circuits cannot and do not run any application pro- 
gram. 

72 . (canceled) 

73. (amended May 15, 2006) The apparatus of claim 50, where- 
in: 

to guard such entire system from failure, the circuits 
receive from such computing system error messages warning of 
incipient failure and issue recovery commands to such comput- 
ing system. 

74. (added October 12, 2 005) The apparatus of claim 50, 
wherein: 

the network is an infrastructure which is generic in that 
it can accommodate any such system that can issue an error 
message and computational results, and can handle a recovery 
command . 

75. (added October 12, 2 0 05) The apparatus of claim 55, 
wherein: 

the program- operating circuits guard any such system from 
failure by issuing a recovery command; and 

the failure-identifying and correcting portions provide 
the recovery command. 
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76. (added October 12, 2005) The apparatus of claim 62, 
wherein: 

the circuits cannot and do not run any application pro- 
gram. 

77. (amended May 15, 2006) The apparatus of claim 62, where- 
in: 

to guard the entire such system from failure, the cir- 
cuits receive from such computing system error messages warn- 
ing of incipient failure. 

78. (added October 12, 2005) The apparatus of claim 62, 
wherein: 

the network is an infrastructure which is generic in that 
it can accommodate any such system that can issue an error 
message and handle a recovery command. 

79. (added October 27, 2005) The apparatus of claim 1, 
wherein: 

the apparatus is not a circuit breaker. 

80. (amended May 15, 2006) The apparatus of claim 1, where- 
in: 

at least one of the network terminals is connected to 
receive at least one error signal generated by such system in 
event of incipient such failure of such system; 

at least one of the network terminals is connected to 
provide at least one recovery signal to such system upon re- 
ceipt of the error signal. 
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1 81. (amended May 15, 2006) An infrastructure for a computing 

2 system that has at least one computing node ("C-node") for 

3 running at least one application program; said infrastructure 

4 being for guarding the system against failure, and comprising: 
s at least one monitoring node ("M-node") for monitoring 

6 the condition of the at least one C-node by waiting for an 

7 error signal, indicating incipient such failure, from the at 

a least one C-node and responding to the error signal by sending 

9 a recovery command to the at least one C-node; and 
10 at least one adapter node ( w A-node") for transmitting the 

2i error signal and recovery command between the at least one C- 

12 node and at least one M-node; and wherein: 

13 the at least one M-node is manufactured, and remains, 

14 wholly distinct from the at least one C-node; and 

is the at least one M-node cannot, and does not, run any 

16 application program. 

1 82. (added October 27, 2005) The infrastructure of claim 81, 

2 further comprising: 

3 such computing system. 
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83, (added October 27, 2 005) The infrastructure of claim 81, 
particularly for use with such computing system that has 
plural such C-nodes; and further comprising: 

a decision -making node ("D-node") for comparing output 
data generated by such plural C-nodes and reporting to the at 
least one M-node any discrepancy between the output data; and 
wherein: 

the at least one M-node analyzes the D-node reporting, 
and based thereon arbitrates among the C-nodes. 
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1 84. (allowed August 24, 2006) An infrastructure for a com- 

2 puting system that has at least one computing node ( w C-node") 

3 for running at least one application program; said infrastruc- 

4 ture being for guarding the system against failure, and 
s comprising: 

6 at least one monitoring node ("M-node") for monitoring 

7 the condition of the at least one C-node by waiting for an 

a error signal, indicating incipient such failure, from the at 

9 least one C-node and responding to the error signal by sending 

10 a recovery command to the at least one C-node; 

n at least one adapter node ( w A-node") for transmitting the 

12 error signal and recovery command between the at least one C- 

13 node and at least one M-node; and wherein: 

14 

is the at least one M-node is manufactured, and remains, 

is wholly distinct from the at least one C-node, 

u and 

18 

19 the at least one M-node cannot, and does not, run any 

20 application program; and 

21 

22 at least one self -checking node for startup, shutdown and 

23 survival ( w S3-node"), specifically for executing power-on and 

24 power-off sequences for such system and for the infrastruc- 

25 ture, and for receiving error signals and sending recovery 

26 commands to the at least one M-node, 
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